Detecting misbehavior in vehicle-to-vehicle (V2V) communications

ABSTRACT

A method includes: receiving, at a host vehicle, a plurality of messages transmitted using Vehicle-to-Vehicle (V2V) communications indicating a heading angle and a speed of a remote vehicle; calculating an expected change in frequency of the plurality of messages received at the host vehicle based on the heading angle and the speed of the remote vehicle; measuring an actual change in frequency of the plurality of messages received at the host vehicle due to the Doppler effect; comparing the expected change in frequency to the actual change in frequency; and determining that the plurality of messages were not transmitted from the remote vehicle when a difference between the expected change in frequency and the actual change in frequency exceeds a predefined frequency change threshold.

CROSS REFERENCE TO RELATED APPLICATIONS

This application is a Divisional of application Ser. No. 14/714,169,filed on May 15, 2015, the entire contents of which are incorporatedherein by reference in its entirety.

BACKGROUND (a) Technical Field

The present disclosure relates generally to automotive communicationsystems, and more particularly, to detecting misbehavior inVehicle-to-Vehicle (V2V) communications.

(b) Background Art

For more than a decade, the United States Department of Transportationand National Highway Traffic Safety Administration have been conductingresearch on Vehicle-to-Vehicle (V2V) communications as a system fortransmitting basic safety information between vehicles to facilitatewarnings to drivers concerning impending crashes. V2V communications, orsimply V2V, involves a dynamic wireless exchange of data between nearbyvehicles offering the opportunity for significant safety improvements.V2V uses on-board dedicated short-range communication (DSRC) radiodevices to transmit messages about a vehicle's speed, heading, brakestatus, and other information to other vehicles and receive the samemessages from other vehicles. These messages, known as Basic SafetyMessages (BSMs), can be derived using non-vehicle-based technologiessuch as global positioning system (GPS) to detect a location and speedof a vehicle, or using vehicle-based sensor data where the location andspeed data is derived from the vehicle's on-board computer. Thevehicle-based sensor data can be combined with other data, such aslatitude, longitude, and angle, to produce a richer, more detailedsituational awareness of the position of other vehicles. Accordingly,exchanging messages with other vehicles using V2V enables a vehicle toautomatically sense the position of surrounding vehicles with 360-degreeawareness as well as the potential hazard they present, calculate riskbased on the position, speed, or trajectory of surrounding vehicles,issue driver advisories or warnings, and take pre-emptive actions toavoid and mitigate crashes. Government agencies and automobilemanufacturers, alike, are working toward widespread adoption of V2V,such that each vehicle on the roadway (e.g., cars, trucks, buses,motorcycles, etc.) is eventually able to communicate with other vehiclesusing V2V.

V2V technology opens the door to myriad benefits of an IntelligentTransportation System. However, with increased interconnectivity, thereis greater risk of harm in the case of a security breach. In the eventthat an attacker is able to circumvent a basic level of security that iscurrently implemented in V2V systems, severe disruptions to trafficcould be caused. For instance, an attacker may be capable of replicatinganother vehicle's authenticity certificate, e.g., by acquiring a DSRCradio from an old or damaged vehicle. In such a case, the attacker couldemulate a vehicle on the roadway that is not actually present,potentially forcing other vehicles to automatically stop or swerve toavoid a perceived collision. Therefore, an additional layer of securityis needed to prevent malicious attackers from breaching current V2Vsecurity measures and emulating virtual vehicles.

SUMMARY OF THE DISCLOSURE

The present disclosure provides an additional level of security in V2Vcommunications that can supplement existing V2V security measures. Inthis regard, the techniques disclosed herein can deter attackers fromsuccessfully emulating a virtual vehicle and thereby causing severedisruptions to traffic and vehicular accidents. A vehicle (e.g., “hostvehicle”) receiving BSMs from a remote entity using V2V communicationscan utilize the Doppler effect to validate the source of the receivedmessages based on the Doppler shift in the carrier frequency. The hostvehicle can further utilize the Doppler effect to validate the source ofthe received messages based on the angular offset of the host vehiclewith respect to the source.

According to embodiments of the present disclosure, a method includes:receiving, at a host vehicle, a plurality of messages transmitted usingVehicle-to-Vehicle (V2V) communications indicating a heading angle and aspeed of a remote vehicle; calculating an expected change in frequencyof the plurality of messages received at the host vehicle based on theheading angle and the speed of the remote vehicle; measuring an actualchange in frequency of the plurality of messages received at the hostvehicle due to the Doppler effect; comparing the expected change infrequency to the actual change in frequency; and determining that theplurality of messages were not transmitted from the remote vehicle whena difference between the expected change in frequency and the actualchange in frequency exceeds a predefined frequency change threshold.

The method may further include: counting a number of times that thedifference between the expected change in frequency and the actualchange in frequency exceeds the predefined frequency change threshold;and determining whether the number of times exceeds a predefined eventthreshold.

The method may further include: calibrating one or more of the frequencychange threshold and the number of times threshold.

The method may further include: determining a heading angle and a speedof the host vehicle.

The expected change in frequency may be calculated based on the headingangle and the speed of the remote vehicle and the heading angle and thespeed of the host vehicle.

The expected change in frequency may be calculated according to thefollowing formula:

${{\Delta\; f_{Calculated}} = {\frac{f}{c}{{{V_{RV} - V_{HV}}} \cdot {{Cos}\left( {H_{RV} - H_{HV}} \right)}}}},$where Δf_(calculated) is the calculated expected change in frequency, fis a frequency of the plurality of messages received at the hostvehicle, c is the speed of light, V_(RV) is the speed of the remotevehicle, V_(HV) is the speed of the host vehicle, H_(RV) is the headingangle of the remote vehicle, and H_(HV) is the heading angle of the hostvehicle.

The method may further include: reporting that the plurality of messageswere not transmitted from the remote vehicle.

The method may further include: determining that the remote vehicle is avirtual vehicle emulated by a remote attacker.

The plurality of messages may be Basic Safety Messages (BSMs).

Furthermore, according to embodiments of the present disclosure, amethod includes: receiving, at a host vehicle, a plurality of messagestransmitted using Vehicle-to-Vehicle (V2V) communications indicating aheading angle and a speed of a remote vehicle; calculating an expectedangular offset of the plurality of messages received at the host vehiclebased on the heading angle of the remote vehicle; measuring an actualangular offset of the plurality of messages received at the hostvehicle; comparing the expected angular offset to the actual angularoffset; and determining that the plurality of messages were nottransmitted from the remote vehicle when a difference between theexpected angular offset and the actual angular offset exceeds apredefined angular offset threshold.

The method may further include: counting a number of times that thedifference between the expected angular offset and the actual angularoffset exceeds the predefined angular offset threshold; and determiningwhether the number of times exceeds a predefined event threshold.

The method may further include: calibrating one or more of the angularoffset threshold and the number of times threshold.

The method may further include: determining a heading angle and a speedof the host vehicle.

The expected angular offset may be calculated based on the heading angleof the remote vehicle and the heading angle of the host vehicle, and theactual angular offset may be measured based on based on a change infrequency of the plurality of messages received at the host vehicle dueto the Doppler effect, the speed of the remote vehicle, and the speed ofthe host vehicle.

The expected angular offset may be calculated according to the followingformula:θ_(Calculated) =H _(RV) −H _(HV),where Θ_(calculated) is the calculated expected angular offset, H_(RV)is the heading angle of the remote vehicle, and H_(HV) is the headingangle of the host vehicle.

The actual angular offset may be measured according to the followingformula:

${\theta_{Measured} = {\cos^{- 1}\left( {\frac{c}{f}\frac{\Delta\; f_{measured}}{{V_{RV} - V_{HV}}}} \right)}},$where Θ_(measured) is the measured actual angular offset, f is afrequency of the plurality of messages received at the host vehicle, cis the speed of light, Δf_(measured) is a measured change in frequencyof the plurality of messages received at the host vehicle, V_(RV) is thespeed of the remote vehicle, and V_(HV) is the speed of the hostvehicle.

The method may further include: reporting that the plurality of messageswere not transmitted from the remote vehicle.

The method may further include: determining that the remote vehicle is avirtual vehicle emulated by a remote attacker.

The plurality of messages may be Basic Safety Messages (BSMs).

Furthermore, according to embodiments of the present disclosure, amethod includes: receiving, at a host vehicle, a plurality of messagestransmitted using Vehicle-to-Vehicle (V2V) communication indicating aheading angle and a speed of a remote vehicle; calculating an expectedchange in frequency of the plurality of messages received at the hostvehicle based on the heading angle and the speed of the remote vehicle;measuring an actual change in frequency of the plurality of messagesreceived at the host vehicle due to the Doppler effect; comparing theexpected change in frequency to the actual change in frequency;calculating an expected angular offset of the plurality of messagesreceived at the host vehicle based on the heading angle of the remotevehicle; measuring an actual angular offset of the plurality of messagesreceived at the host vehicle; comparing the expected angular offset tothe actual angular offset; and determining that the plurality ofmessages were not transmitted from the remote vehicle when a differencebetween the expected change in frequency and the actual change infrequency exceeds a predefined frequency change threshold or when adifference between the expected angular offset and the actual angularoffset exceeds a predefined angular offset threshold.

Furthermore, according to embodiments of the present disclosure, anon-transitory computer readable medium containing program instructionsfor performing a method includes: program instructions that receive, ata host vehicle, a plurality of messages transmitted usingVehicle-to-Vehicle (V2V) communications indicating a heading angle and aspeed of the remote vehicle; program instructions that calculate anexpected change in frequency of the plurality of messages received atthe host vehicle based on the heading angle and the speed of the remotevehicle; program instructions that measure an actual change in frequencyof the plurality of messages received at the host vehicle due to theDoppler effect; program instructions that compare the expected change infrequency to the actual change in frequency; and program instructionsthat determine that the plurality of messages were not transmitted fromthe remote vehicle when a difference between the expected change infrequency and the actual change in frequency exceeds a predefinedfrequency change threshold.

Furthermore, according to embodiments of the present disclosure, anon-transitory computer readable medium containing program instructionsfor performing a method includes: program instructions that receive, ata host vehicle, a plurality of messages transmitted usingVehicle-to-Vehicle (V2V) communications indicating a heading angle and aspeed of the remote vehicle; program instructions that calculate anexpected angular offset of the plurality of messages received at thehost vehicle based on the heading angle of the remote vehicle; programinstructions that measure an actual angular offset of the plurality ofmessages received at the host vehicle; program instructions that comparethe expected angular offset to the actual angular offset; and programinstructions that determine that the plurality of messages were nottransmitted from the remote vehicle when a difference between theexpected angular offset and the actual angular offset exceeds apredefined angular offset threshold.

Furthermore, according to embodiments of the present disclosure, anon-transitory computer readable medium containing program instructionsfor performing a method includes: program instructions that receive, ata host vehicle, a plurality of messages transmitted usingVehicle-to-Vehicle (V2V) communications indicating a heading angle and aspeed of the remote vehicle; program instructions that calculate anexpected change in frequency of the plurality of messages received atthe host vehicle based on the heading angle and the speed of the remotevehicle; program instructions that measure an actual change in frequencyof the plurality of messages received at the host vehicle due to theDoppler effect; program instructions that compare the expected change infrequency to the actual change in frequency; program instructions thatcalculate an expected angular offset of the plurality of messagesreceived at the host vehicle based on the heading angle of the remotevehicle; program instructions that measure an actual angular offset ofthe plurality of messages received at the host vehicle; programinstructions that compare the expected angular offset to the actualangular offset; and program instructions that determine that theplurality of messages were not transmitted from the remote vehicle whena difference between the expected change in frequency and the actualchange in frequency exceeds a predefined frequency change threshold orwhen a difference between the expected angular offset and the actualangular offset exceeds a predefined angular offset threshold.

BRIEF DESCRIPTION OF THE DRAWINGS

The embodiments herein may be better understood by referring to thefollowing description in conjunction with the accompanying drawings inwhich like reference numerals indicate identically or functionallysimilar elements, of which:

FIGS. 1A-1C illustrate example security breach scenarios in V2Vcommunications;

FIG. 2 illustrates an example basic safety message (BSM) construction;

FIGS. 3A and 3B illustrate an example demonstration of the Dopplereffect in messages sent between two vehicles;

FIG. 4 illustrates an example simplified procedure for performing remotevehicle frequency shift authentication; and

FIG. 5 illustrates an example simplified procedure for performing remotevehicle angle authentication.

It should be understood that the above-referenced drawings are notnecessarily to scale, presenting a somewhat simplified representation ofvarious preferred features illustrative of the basic principles of thedisclosure. The specific design features of the present disclosure,including, for example, specific dimensions, orientations, locations,and shapes, will be determined in part by the particular intendedapplication and use environment.

DETAILED DESCRIPTION OF THE EMBODIMENTS

The terminology used herein is for the purpose of describing particularembodiments only and is not intended to be limiting of the disclosure.As used herein, the singular forms “a”, “an” and “the” are intended toinclude the plural forms as well, unless the context clearly indicatesotherwise. It will be further understood that the terms “comprises”and/or “comprising,” when used in this specification, specify thepresence of stated features, integers, steps, operations, elements,and/or components, but do not preclude the presence or addition of oneor more other features, integers, steps, operations, elements,components, and/or groups thereof. As used herein, the term “and/or”includes any and all combinations of one or more of the associatedlisted items. The term “coupled” denotes a physical relationship betweentwo components whereby the components are either directly connected toone another or indirectly connected via one or more intermediarycomponents.

It is understood that the term “vehicle” or “vehicular” or other similarterm as used herein is inclusive of motor vehicles, in general, such aspassenger automobiles including sports utility vehicles (SUV), buses,trucks, various commercial vehicles, watercraft including a variety ofboats and ships, aircraft, and the like, and includes hybrid vehicles,electric vehicles, hybrid electric vehicles, hydrogen-powered vehiclesand other alternative fuel vehicles (e.g., fuels derived from resourcesother than petroleum). As referred to herein, an electric vehicle (EV)is a vehicle that includes, as part of its locomotion capabilities,electrical power derived from a chargeable energy storage device (e.g.,one or more rechargeable electrochemical cells or other type ofbattery). An EV is not limited to an automobile and may includemotorcycles, carts, scooters, and the like. Furthermore, a hybridvehicle is a vehicle that has two or more sources of power, for exampleboth gasoline-based power and electric-based power (e.g., a hybridelectric vehicle (HEV)).

Additionally, it is understood that one or more of the below methods, oraspects thereof, may be executed by at least one controller orcontroller area network (CAN) bus. The controller or controller areanetwork (CAN) bus may be implemented in a vehicle, such as the hostvehicle described herein. The term “controller” may refer to a hardwaredevice that includes a memory and a processor. The memory is configuredto store program instructions, and the processor is specificallyprogrammed to execute the program instructions to perform one or moreprocesses which are described further below. Moreover, it is understoodthat the below methods may be executed by a system comprising thecontroller in conjunction with one or more additional components, asdescribed in detail below.

Furthermore, the controller of the present disclosure may be embodied asnon-transitory computer readable media on a computer readable mediumcontaining executable program instructions executed by a processor,controller or the like. Examples of the computer readable mediumsinclude, but are not limited to, ROM, RAM, compact disc (CD)-ROMs,magnetic tapes, floppy disks, flash drives, smart cards and optical datastorage devices. The computer readable recording medium can also bedistributed in network coupled computer systems so that the computerreadable media is stored and executed in a distributed fashion, e.g., bya telematics server or a Controller Area Network (CAN).

Referring now to embodiments of the present disclosure, the disclosedtechniques deter attackers from successfully emulating a virtual vehicleand thereby causing severe disruptions to traffic and vehicularaccidents. A vehicle (e.g., “host vehicle”) receiving BSMs from a remoteentity using V2V communications can utilize the Doppler effect tovalidate the source of the received messages based on the Doppler shiftin the carrier frequency. The host vehicle can further utilize theDoppler effect to validate the source of the received messages based onthe angular offset of the host vehicle with respect to the source.

FIGS. 1A-1C illustrate example security breach scenarios in V2Vcommunications. As shown in FIGS. 1A-1C, a host vehicle (HV) 100traveling on a roadway may be V2V communications-enabled, allowing thevehicle 100 to transmit messages (e.g., BSMs) to other vehiclesincluding various informational data (e.g., vehicle's location, speed,heading, brake status, etc.) and receive the same messages from othervehicles. As such, the host vehicle 100 may receive a plurality ofmessages 130 (e.g., BSMs) transmitted using V2V communications from aremote source. The messages 130 may be signals sent from a DSRC radio,for example.

An example BSM construction is illustrated in FIG. 2. The BSM is optimalfor low latency, localized broadcast required by V2V safetyapplications. As such, BSMs are transmitted over DSRC having a range ofapproximately 1,000 meters. As shown in FIG. 2, an example BSM consistsof two parts: BSM Part I and BSM Part II. BSM Part I contains the coredata elements (e.g., vehicle size, position, speed, heading angle,acceleration, brake system status, etc.). The BSM Part 1 is typicallytransmitted approximately 10 times per second. Meanwhile, BSM Part IIcontains a variable set of data elements drawn from various optionaldata elements. BSM Part II can sometimes be added to Part I depending onrecent events (e.g., anti-lock braking system activation, ambienttemperature/air pressure, weather information, exterior lights status,etc.). Notably, as BSM construction continues to evolve, the BSMs beingexchanged between vehicles, such as the host vehicle 100 and remotevehicle 110, may contain any suitable configuration of informationaldata. Thus, the data types depicted in FIG. 2 are for demonstrationpurposes only and should not be treated as limiting the scope of thepresent claims.

The received messages 130 may indicate the presence of a remote vehicle(RV) 110 traveling on the same roadway as the host vehicle 100. Themessages 130 may indicate various informational data regarding theremote vehicle 110, such as speed, heading angle, location, brakestatus, and the like. Typically, the host vehicle 100 can automaticallyinitiate actions to promote safety in response to information regardingthe remote vehicle 110. For instance, if the messages 130 indicate thatthe remote vehicle 110 is rapidly approaching the host vehicle 100head-on, based on the speed and heading angle of the remote vehicle 110,the host vehicle 100 can issue driver advisories or warnings, or eventake pre-emptive actions to avoid and mitigate a potential crash, suchas turning or stopping the vehicle.

However, as shown in FIGS. 1A-1C, the plurality of messages 130 mayactually be transmitted from a remote attacker 120, meaning the remotevehicle 110 does not actually exist. Rather, the remote attacker 120 isemulating the remote vehicle 110 by sending the messages 130 using V2Vcommunications indicating an artificial presence of the remote vehicle110. That is, the plurality of messages 130 received by the host vehicle100 appear to be transmitted from a remote vehicle 110, based on theinformation in the messages 130. In reality though, the messages 130 aresent from a remote attacker 120 pretending to be the remote vehicle 110.

In one example, the attacker 120 may be positioned on the side of theroadway on which the host vehicle 100 is travelling (likely with othervehicles). The attacker 120 may have acquired a DSRC radio from an oldor damaged vehicle (e.g., in a salvage yard, black market, etc.) that ispre-loaded with valid V2V certificates. Thus, the attacker 120 can sendDSRC signals using the DSRC radio and effectively communicate withvehicles passing by. Notably, in order to ensure that the host vehicle100 receives the messages 130, the attacker 120 has to accurately directthe messages 130 toward the host vehicle 100, e.g., using a directionalantenna. This becomes increasingly more difficult for the attacker 120when multiple vehicles are traveling on the roadway.

Referring now to FIG. 1A, the messages 130 received at the host vehicle100 may indicate that a remote vehicle 110 is traveling at 20 m/s towardthe host vehicle 100. Meanwhile, in FIG. 1B, the messages 130 receivedat the host vehicle 100 may indicate that the remote vehicle 110 isstationary but located ahead of the host vehicle 100. It should be notedthat the attacker 120 is located in the same position in both scenarios(i.e., the attacker 120 is stationary). Thus, the angle at which themessages 130 are received at the host vehicle 100 is the same in bothscenarios. A scenario similar to that of FIG. 1B is shown in FIG. 1C,except that multiple host vehicles 100 are traveling on the roadway, andthe attacker 120 attempts to transmit messages 130 using V2Vcommunications to each of the host vehicles. In each scenario shown inFIGS. 1A-1C, the messages 130 indicate a speed and a heading angle ofthe remote vehicle 110, along with other informational data such aslocation, vehicle type, brake status, etc.

In response to receiving the plurality of messages 130 transmitted fromthe attacker 120 using V2V communications, the host vehicle 100 canutilize the Doppler effect to validate the source from which themessages 130 are transmitted. In this regard, the Doppler effect (orDoppler shift) is the change in frequency of a wave (or other periodicevent) for an observer moving relative to its source. FIGS. 3A and 3Billustrate an example demonstration of the Doppler effect in messagessent between two vehicles. Similar to the scenarios depicted in FIGS.1A-1C, a remote vehicle 110 transmits a plurality of messages 130 usingV2V communications to surrounding vehicles including the host vehicle100 (though, in FIGS. 1A-1C, the remote vehicle 110 is actually emulatedby the attacker 120). In FIG. 3A, both of the remote vehicle 110 andhost vehicle 100 are stationary. Because of this, there is nocompression (or decompression) of the signals 130 being transmitted.Therefore, there is no perceived change in the frequency of the messages130 received at the host vehicle 100.

However, when the source of the waves is moving toward the observer,each successive wave crest is emitted from a position closer to theobserver than the previous wave. Therefore, each wave takes slightlyless time to reach the observer than the previous wave. Hence, the timebetween the arrival of successive wave crests at the observer isreduced, causing an increase in the frequency. This scenario isdemonstrated in FIG. 3B, where the remote vehicle 110 is travelingtoward the host vehicle 100 while transmitting the messages 130. Asshown in FIG. 3B, due to the movement of the remote vehicle 110, thedistance between successive wave fronts is reduced, so the wavescompress. Conversely, if the source of waves is moving away from theobserver, each wave is emitted from a position farther from the observerthan the previous wave, so the arrival time between successive waves isincreased, reducing the frequency. The distance between successive wavefronts is then increased, so the waves decompress.

Accordingly, when a wave source (e.g., remote vehicle 110) and areceiver (e.g., the host vehicle 100) are moving relative to oneanother, the frequency of the received signals will not be the same asthe frequency emitted from the source. When they are moving towards eachother, the frequency of the observed signal is higher than the frequencyemitted at the source. This phenomenon is known as the Doppler effect.The rate of frequency change due to the Doppler effect depends on therelative motion between the source and receiver and on the speed ofpropagation of the wave. The Doppler shift in frequency can becalculated according to the following formula:

${F_{D} = {{\Delta\; f} = {{\pm {fc}}\frac{V}{c}\cos\;\beta}}},$where F_(D) and Δf is the change in frequency (i.e., frequency shift) ofthe source observed at the receiver, fc is the frequency at the source,V is the speed difference (i.e., relative velocity) between the sourceand transmitter, c is the speed of light, and β is the angle of thevelocity vector. The change in frequency is maximized when β=0 (i.e.,when the source and receiver are moving in the same or oppositedirection). Similarly, as the relative velocity between the source andreceiver increases, so does the change in frequency.

As stated above, the host vehicle 100 can utilize the Doppler effect tovalidate the source from which the messages 130 are transmitted bycomparing the measured frequency shift to the expected frequency shift.Particularly, the host vehicle 100 may: 1) measure the actual change infrequency of the messages 130 received at the host vehicle 100 resultingfrom the Doppler effect, 2) calculate the expected change in frequencyof the messages 130 received at the host vehicle 100 based oninformation about the remote vehicle 110 that is indicated in themessages 130, and 3) compare the actual change in frequency of thereceived messages 130 to the expected change in frequency of thereceived messages 130. If the difference between the actual change infrequency and the expected change in frequency exceeds a predefinedfrequency change threshold, the host vehicle 100 may determine that V2Vmisbehavior has occurred. That is, the messages 130 received at the hostvehicle 100 were not actually sent from the remote vehicle 110. As aresult, the host vehicle 100 can elect to forgo any attempt to mitigatean accident or collision involving the remote vehicle 110, disregard thereceived messages 130, report the detected V2V misbehavior (e.g., bysending a reporting message to a V2V communications server), and soforth.

FIG. 4 illustrates an example simplified procedure for performing remotevehicle frequency shift authentication. The procedure 400 may start atstep 405, and continue to step 410, where, as described in greaterdetail herein, the Doppler effect can be utilized to validate the sourcefrom which the messages 130 are transmitted by comparing the measuredfrequency shift to the expected frequency shift.

At step 410, a plurality of messages 130 (e.g., BSMs) are received atthe host vehicle 100. The messages 130 may include various informationaldata about a remote vehicle 110, such as the remote vehicle's headingangle (H_(RV)) and the remote vehicle's speed (V_(RV)) (step 415).Additional informational data typically included in the messages 130 isset forth in FIG. 2. At steps 420 and 425, the host vehicle 100, or morespecifically, a controller/controller area network (CAN) bus of the hostvehicle 100, can determine its own heading angle (H_(HV)) and speed(V_(HV)). Based on this information (i.e., the heading angle and speedof the remote vehicle 110 and the heading angle and speed of the hostvehicle 100), the expected change in frequency (or frequency shift) ofthe messages 130 received at the host vehicle 100 can be calculated(Δf_(calculated)), at step 430. In particular, the expected change infrequency can be calculated according to the following formula:

${{\Delta\; f_{Calculated}} = {\frac{f}{c}{{{V_{RV} - V_{HV}}} \cdot {{Cos}\left( {H_{RV} - H_{HV}} \right)}}}},$where Δf_(calculated) is the calculated expected change in frequency, fis the frequency of the messages 130 received at the host vehicle 100, cis the speed of light, V_(RV) is the speed of the remote vehicle 110,V_(HV) is the speed of the host vehicle 100, H_(RV) is the heading angleof the remote vehicle 110, and H_(HV) is the heading angle of the hostvehicle 100.

Meanwhile, at step 435, the actual change in carrier frequency of themessages 130 received at the host vehicle 100 due to the Doppler effectcan be measured (Δf_(Measured)). For instance, the host vehicle 100 canrecord the carrier frequency offset of the preamble of the receivedmessages 130. Then, at step 440, the host vehicle 100 may compare thecalculated change in frequency of the received messages 130(Δf_(Calculated)) to the measured change in frequency of the receivedmessages 130 (Δf_(Measured)) by computing a difference between thecalculated change in frequency and the measured change in frequency andcomparing the difference to a predefined frequency change threshold. Thefrequency change threshold may be adjusted or calibrated, as desired,such that the remote vehicle frequency shift authentication is more orless sensitive. If the difference between the calculated change infrequency and the measured change in frequency is less than or equal tothe frequency change threshold, the procedure 400 may return to step405, and the host vehicle 100 may assume that the remote vehicle 110indicated in the received messages 130 is actually transmitting themessages to the host vehicle 100 (step 445). However, if the differencebetween the calculated change in frequency and the measured change infrequency exceeds the frequency change threshold, the host vehicle 100may determine that V2V misbehavior has occurred (step 465). That is, theplurality of messages 130 were not transmitted from the remote vehicle110, and rather, the messages 130 were sent from a remote attacker(e.g., attacker 120) emulating the remote vehicle 110.

Notably, optional steps 450, 455 and 460 may be incorporated into theremote vehicle frequency shift authentication procedure if a singleoccurrence of frequency shift discrepancy is insufficient to concludethat V2V misbehavior has occurred. In this regard, an event counter(Δf_(Th_Event)) may be incremented, at step 450, in order to track thenumber of times that the difference between the calculated change infrequency and the measured change in frequency exceeds the frequencychange threshold. Then, at step 455, it can be determined whether theevent counter (i.e., the number of times that the difference exceeds thefrequency change threshold) exceeds a predefined event threshold.Similar to the frequency change threshold, the event threshold may beadjusted or calibrated, as desired, such that the remote vehiclefrequency shift authentication is more or less sensitive. If the eventcounter is less than or equal to the event threshold, the procedure 400may return to step 405, and the host vehicle 100 may repeat the remotevehicle frequency shift authentication to perform additional testing ofthe frequency shift (step 460). However, if the event counter exceedsthe event threshold, the host vehicle 100 may determine that V2Vmisbehavior has occurred (step 465).

The procedure 400 illustratively ends at step 465. The techniques bywhich the steps of procedure 400 may be performed, as well as ancillaryprocedures and parameters, are described in detail above.

It should be noted that the steps shown in FIG. 4 are merely examplesfor illustration, and certain other steps may be included or excluded asdesired. Further, while a particular order of the steps is shown, thisordering is merely illustrative, and any suitable arrangement of thesteps may be utilized without departing from the scope of theembodiments herein. Even further, the illustrated steps may be modifiedin any suitable manner in accordance with the scope of the presentclaims.

In addition, the host vehicle 100 can utilize the Doppler effect tovalidate the source from which the messages 130 are transmitted bycalculating an angular difference between the transmission points of theexpected remote vehicle 110 and the actual location of the messages 130coming from the attacker 120 (illustratively located on the side of theroadway). To this end, the host vehicle 100 may compute the angularoffset (i.e., the angle of the velocity vector (β)) of the receivedmessages 130, which represents the angle of the location of the source(either the perceived remote vehicle 110 or the attacker 120) withrespect to the host vehicle 100. Particularly, the host vehicle 100may: 1) measure the actual angular offset of the messages 130 receivedat the host vehicle 100 resulting from the Doppler effect, 2) calculatethe expected angular offset of the messages 130 received at the hostvehicle 100 based on information about the remote vehicle 110 that isindicated in the messages 130, and 3) compare the actual angular offsetof the received messages 130 to the expected angular offset of thereceived messages 130. If the difference between the actual angularoffset and the expected angular offset exceeds a predefined angularoffset threshold, the host vehicle 100 may determine that V2Vmisbehavior has occurred. That is, the messages 130 received at the hostvehicle 100 were not actually sent from the remote vehicle 110. As aresult, the host vehicle 100 can elect to forgo any attempt to mitigatean accident or collision involving the remote vehicle 110, disregard thereceived messages 130, report the detected V2V misbehavior (e.g., bysending a reporting message to a V2V communications server), and soforth.

FIG. 5 illustrates an example simplified procedure for performing remotevehicle angle authentication. The procedure 500 may start at step 505,and continue to step 510, where, as described in greater detail herein,the Doppler effect can be utilized to validate the source from which themessages 130 are transmitted by calculating an angular differencebetween the transmission points of the expected remote vehicle 110 andthe actual location of the messages 130 coming from the attacker 120.The remote vehicle angle authentication process is similar to the remotevehicle frequency shift authentication depicted in FIG. 4. The inputsare identical to the remote vehicle frequency shift authentication, andformulas used in the remote vehicle angle authentication are similar tothose used in the remote vehicle frequency shift authentication, exceptrearranged to make a comparison in terms of an angle.

At step 510, a plurality of messages 130 (e.g., BSMs) are received atthe host vehicle 100. The messages 130 may include various informationaldata about a remote vehicle 110, such as the remote vehicle's headingangle (H_(RV)) and the remote vehicle's speed (V_(RV)) (step 515). Atsteps 520 and 525, the host vehicle 100, or more specifically, acontroller/controller area network (CAN) bus of the host vehicle 100,can determine its own heading angle (H_(HV)) and speed (V_(HV)). Basedon this information (i.e., the heading angle of the remote vehicle 110and the heading angle of the host vehicle 100), the expected angularoffset of the messages 130 received at the host vehicle 100 can becalculated (Θ_(Calculated)), at step 530. In particular, the expectedangular offset can be calculated according to the following formula:θ_(Calculated) =H _(RV) −H _(HV),where Θ_(calculated) is the calculated expected angular offset, H_(RV)is the heading angle of the remote vehicle, and H_(HV) is the headingangle of the host vehicle.Meanwhile, at step 535, the actual change in carrier frequency of themessages 130 received at the host vehicle 100 due to the Doppler effectcan be measured (Δf_(Measured)). For instance, the host vehicle 100 canrecord the carrier frequency offset of the preamble of the receivedmessages 130. Then, at step 540, the host vehicle 100 may measure theactual angular offset of the plurality of messages 130 received at thehost vehicle 100 resulting from the Doppler effect. The actual angularoffset (Θ_(measured)) may be measured based on the change in frequencyof the messages 130 received at the host vehicle 100 due to the Dopplereffect (determined at step 535), the speed of the remote vehicle 110,and the speed of the host vehicle 100. In particular, the actual angularoffset can be measured according to the following formula:

${\theta_{Measured} = {\cos^{- 1}\left( {\frac{c}{f}\frac{\Delta\; f_{measured}}{{V_{RV} - V_{HV}}}} \right)}},$

where Θ_(measured) is the measured actual angular offset, f is thefrequency of the plurality of messages 130 received at the host vehicle100, c is the speed of light, Δf_(measured) is the measured change infrequency (frequency shift) of the plurality of messages 130 received atthe host vehicle 100, V_(RV) is the speed of the remote vehicle 110, andV_(HV) is the speed of the host vehicle 100.

Then, at step 545, the host vehicle 100 may compare the calculatedangular offset of the received messages 130 (Θ_(Calculated)) to themeasured angular offset of the received messages 130 (Θ_(Measured)) bycomputing a difference between the calculated angular offset and themeasured angular offset and comparing the difference to a predefinedangular offset threshold. The angular offset threshold may be adjustedor calibrated, as desired, such that the remote vehicle angleauthentication is more or less sensitive. If the difference between thecalculated angular offset and the measured angular offset is less thanor equal to the angular offset threshold, the procedure 500 may returnto step 505, and the host vehicle 100 may assume that the remote vehicle110 indicated in the received messages 130 is actually transmitting themessages to the host vehicle 100 (step 550). However, if the differencebetween the calculated angular offset and the measured angular offsetexceeds the angular offset threshold, the host vehicle 100 may determinethat V2V misbehavior has occurred (step 570). That is, the plurality ofmessages 130 were not transmitted from the remote vehicle 110, andrather, the messages 130 were sent from a remote attacker (e.g.,attacker 120) emulating the remote vehicle 110.

Notably, optional steps 555, 560 and 565 may be incorporated into theremote vehicle angular offset authentication procedure if a singleoccurrence of angular discrepancy is insufficient to conclude that V2Vmisbehavior has occurred. In this regard, an event counter(Δf_(Th_Event)) may be incremented, at step 555, in order to track thenumber of times that the difference between the calculated angularoffset and the measured angular offset exceeds the angular offsetthreshold. Then, at step 560, it can be determined whether the eventcounter (i.e., the number of times that the difference exceeds theangular offset threshold) exceeds a predefined event threshold. Similarto the angular offset threshold, the event threshold may be adjusted orcalibrated, as desired, such that the remote vehicle angleauthentication is more or less sensitive. If the event counter is lessthan or equal to the event threshold, the procedure 500 may return tostep 505, and the host vehicle 100 may repeat the remote vehicle angleauthentication to perform additional testing of the angular offset (step565). However, if the event counter exceeds the event threshold, thehost vehicle 100 may determine that V2V misbehavior has occurred (step570).

The procedure 500 illustratively ends at step 570. The techniques bywhich the steps of procedure 500 may be performed, as well as ancillaryprocedures and parameters, are described in detail above.

It should be noted that the steps shown in FIG. 5 are merely examplesfor illustration, and certain other steps may be included or excluded asdesired. Further, while a particular order of the steps is shown, thisordering is merely illustrative, and any suitable arrangement of thesteps may be utilized without departing from the scope of theembodiments herein. Even further, the illustrated steps may be modifiedin any suitable manner in accordance with the scope of the presentclaims.

Referring back to the security breach scenarios in V2V communicationsdepicted in FIGS. 1A-1C, one of the remote vehicle frequency shiftauthentication procedure depicted in FIG. 4 and the remote vehicle angleauthentication depicted in FIG. 5, or a combination of both, may beemployed by the host vehicle 100 to detect V2V misbehavior upon receiptof the plurality of messages 130 using V2V communications. For example,in FIG. 1A, where the received messages 130 indicate that a remotevehicle 110 is traveling toward the host vehicle 100 at a speed of 20m/s, either of the remote vehicle frequency shift authentication or theremote vehicle angle authentication could be used to determine that themessages 130 are actually being transmitted by an attacker 120 locatedon the side of the roadway. If employing the remote vehicle frequencyshift authentication, for instance, whereas the messages 130 indicateremote vehicle 110 is purportedly traveling toward the host vehicle 100at a speed of 20 m/s, the host vehicle 100 can determine that the actualsource of the messages 130 (i.e., attacker 120) is stationary, accordingto a measurement of the actual change in frequency of the receivedmessages 130 resulting from the Doppler effect (there would be no changein frequency). In other words, the host vehicle 100 is expecting afrequency change in the carrier waves of the messages 130 because theremote vehicle 110 is broadcasting that it is moving. However, utilizingthe Doppler effect, the attacker's carrier waves indicate that thesource is actually stationary.

In FIG. 1B, where the received messages 130 indicate that the remotevehicle 110 is stationary, either of the remote vehicle frequency shiftauthentication or the remote vehicle angle authentication could again beused to determine that the messages 130 are actually being transmittedby an attacker 120 located on the side of the roadway. This scenario maybe slightly more difficult to detect than that of FIG. 1, since both theremote vehicle 110 and attacker 120 are stationary. Thus, the remotevehicle angle authentication may be more effective in such a case, asthere is a detectable angular difference between the transmission pointsof the expected remote vehicle 110 and the location of the actual DSRCtransmissions 130 coming from the attacker 120 on the side of the road.

In FIG. 1C, where the received messages 130 indicate that the remotevehicle 110 is again stationary, and there are multiple host vehicles100 traveling on the roadway, either of the remote vehicle frequencyshift authentication or the remote vehicle angle authentication couldagain be used to detect V2V misbehavior. Notably though, having multiplevehicles (e.g., host vehicles 100) traveling on the roadwaysimultaneously makes it very difficult for the attacker 120, since theattacker 120 would need to predict all host vehicle 100 locations withina given radius (e.g., 800 m) on a frequently recurring basis (e.g.,every 100 ms). Furthermore, the attacker 120 would need to utilize oneperfectly accurate directional antenna for every host vehicle 100 inrange to mask the other host vehicles from diagnosing the V2Vmisbehavior.

Accordingly, techniques are described herein that provide enhancedsecurity from attackers trying to emulate a vehicle. These benefits canbe achieved with little additional cost because no additional sensors orhardware is required. Also, V2V technology is expected to eventually bestandard equipment on all vehicles sold in North America. However, withgreater interconnectivity, there is greater risk of harm in the case ofa security breach. Thus, the techniques described herein for bolsteringV2V security against particular malicious attacks are highly beneficial.

While there have been shown and described illustrative embodiments thatprovide for detecting misbehavior in V2V communications, it is to beunderstood that various other adaptations and modifications may be madewithin the spirit and scope of the embodiments herein. For instance, V2Vcommunications and BSM standards will continue to evolve over time, andthe security measures disclosed herein should not be treated as tied toonly a particular version of V2V communications and BSMs. In otherwords, the scope of the present disclosure is intended to encompass allfuture implementations of V2V communications and BSM. The embodiments ofthe present disclosure may be modified in any suitable manner inaccordance with the scope of the present claims.

The foregoing description has been directed to embodiments of thepresent disclosure. It will be apparent, however, that other variationsand modifications may be made to the described embodiments, with theattainment of some or all of their advantages. Accordingly, thisdescription is to be taken only by way of example and not to otherwiselimit the scope of the embodiments herein. Therefore, it is the objectof the appended claims to cover all such variations and modifications ascome within the true spirit and scope of the embodiments herein.

What is claimed is:
 1. A method comprising: receiving, at a hostvehicle, a plurality of messages transmitted using Vehicle-to-Vehicle(V2V) communications indicating a heading angle and a speed of a remotevehicle, wherein the plurality of messages are Basic Safety Messages(BSMs); calculating an expected angular offset of the plurality ofmessages received at the host vehicle based on the heading angle of theremote vehicle; measuring an actual angular offset of the plurality ofmessages received at the host vehicle; comparing the expected angularoffset to the actual angular offset; determining that the plurality ofmessages were not transmitted from the remote vehicle when a differencebetween the expected angular offset and the actual angular offsetexceeds a predefined angular offset threshold; and counting a number oftimes that the difference between the expected angular offset and theactual angular offset exceeds the predefined angular offset threshold;and determining whether the number of times exceeds a redefined eventthreshold.
 2. The method of claim 1, further comprising: calibrating oneor more of the angular offset threshold and the number of timesthreshold.
 3. The method of claim 1, further comprising: determining aheading angle and a speed of the host vehicle.
 4. The method of claim 3,wherein: the expected angular offset is calculated based on the headingangle of the remote vehicle and the heading angle of the host vehicle,and the actual angular offset is measured based on based on a change infrequency of the plurality of messages received at the host vehicle dueto the Doppler effect, the speed of the remote vehicle, and the speed ofthe host vehicle.
 5. The method of claim 4, wherein: the expectedangular offset is calculated according to the following formula: whereOcalculated is the calculated expected angular offset, H_(RV) is theheading angle of the remote vehicle, and HH_(V) is the heading angle ofthe host vehicle, and the actual angular offset is measured according tothe following formula:$\theta_{Measured} = {\cos^{- 1}\left( {\frac{c}{f}\frac{\Delta\; f_{measured}}{{V_{RV} - V_{HV}}}} \right)}$where Omeasured is the measured actual angular offset, f is a frequencyof the plurality of messages received at the host vehicle, c is thespeed of light, Δf_(measured) is a measured change in frequency of theplurality of messages received at the host vehicle, V_(RV) is the speedof the remote vehicle, and VH_(V) is the speed of the host vehicle. 6.The method of claim 1, further comprising: reporting that the pluralityof messages were not transmitted from the remote vehicle.
 7. The methodof claim 1, further comprising: determining that the remote vehicle is avirtual vehicle emulated by a remote attacker.
 8. A non-transitorycomputer readable medium containing program instructions for performinga method, the computer readable medium comprising: program instructionsthat receive, at a host vehicle, a plurality of messages transmittedusing Vehicle-to-Vehicle (V2V) communications indicating a heading angleand a speed of the remote vehicle, wherein the plurality of messages areBasic Safety Messages (BSMs); program instructions that calculate anexpected angular offset of the plurality of messages received at thehost vehicle based on the heading angle of the remote vehicle; programinstructions that measure an actual angular offset of the plurality ofmessages received at the host vehicle; program instructions that comparethe expected angular offset to the actual angular offset; programinstructions that determine that the plurality of messages were nottransmitted from the remote vehicle when a difference between theexpected angular offset and the actual angular offset exceeds apredefined angular offset threshold; and program instructions that counta number of times that the difference between the expected angularoffset and the actual angular offset exceeds the predefined angularoffset threshold; and program instructions that determine whether thenumber of times exceeds a predefined event threshold.